The FI should identify the threats and vulnerabilities applicable to its IT environment, including information assets maintained or supported by third party service providers; internal sabotage, malware and data theft are examples of threats with severe potential impact.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.